{"id":83443,"date":"2020-05-31T13:42:09","date_gmt":"2020-05-31T11:42:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls"},"modified":"2020-05-31T13:42:09","modified_gmt":"2020-05-31T11:42:09","slug":"ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","title":{"rendered":"AddTrusti juursertifikaadi aegumine p\u00f5hjustas OpenSSL ja GnuTLS s\u00fcsteemide t\u00f5rkeid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

30. mai m\u00f6\u00f6dus 20-aastane kehtivusaeg juursertifikaadile AddTrust<\/a><\/noindex>, mis kasutati<\/a><\/noindex> \u00fche suurima sertifitseerimiskeskuse Sectigo (Comodo) sertifikaatides ristsignatuuri (cross-signed) loomiseks. Ristsignatuur tagas \u00fchilduvuse vanade seadmetega, mille juursertifikaatide hoiustikku ei olnud lisatud uut juursertifikaati USERTRust. <\/p>\n

\"AddTrusti<\/a><\/noindex><\/center><\/p>\n

Teoreetiliselt pidi AddTrust'i juursertifikaadi kehtivuse l\u00f5pp viima vaid \u00fchilduvuse kadumiseni aegunud s\u00fcsteemidega (Android 2.3, Windows XP, Mac OS X 10.11, iOS 9 jne.), kuna teine juursertifikaat, mida ristsignatuuris kasutatakse, j\u00e4\u00e4b kehtivaks ja kaasaegsed brauserid arvestavad seda usaldusketi kontrollimisel. Praktikas ilmusid<\/a><\/noindex> probleemid ristsignatuuri kontrollimisel TLS-klientides, mis ei kasuta brausereid, sealhulgas OpenSSL 1.0.x ja GnuTLS baasil. Turvaline \u00fchendus lakkas toimumast, andes vea aegunud sertifikaadi kohta, kui serveris on kasutusel Sectigo sertifikaat, mis on usaldusketis seotud AddTrust'i juursertifikaadiga.<\/p>\n

Kui kaasaegsete brauserite kasutajad ei m\u00e4rganud AddTrust'i juursertifikaadi aegumist ristsignatuuriga sertifikaatide t\u00f6\u00f6tlemisel, siis erinevates kolmandate osapoolte rakendustes ja serverite t\u00f6\u00f6tlejates hakkasid esinema probleemid, mis viisid katkestusteni<\/a><\/noindex> t\u00f6\u00f6s<\/a><\/noindex> paljusid infrastruktuure, mis kasutavad kr\u00fcpteeritud sidekanaleid komponentide vaheline suhtlemiseks. <\/p>\n

N\u00e4iteks ilmnesid probleemile<\/a><\/noindex> m\u00f5ningate Debian ja Ubuntu pakettide hoidlate juurde p\u00e4\u00e4suga (apt hakkas sertifikaadi kontrollimise t\u00f5rkeid andma) on hakanud skriptide k\u00e4sitlemise korral tulema t\u00f5rkeid utiliitide «curl» ja «wget» abil ning Git'i kasutamisel on ilmnenud t\u00f5rked. katkestas<\/a><\/noindex> Roku striimimisplatvormi t\u00f6\u00f6, l\u00f5petasid t\u00f6\u00f6tlusk\u00e4itlejad Stripe<\/a><\/noindex> ja DataDog<\/a><\/noindex>, hakkasid ilmnema kokkuvarisemised<\/a><\/noindex> Heroku rakendustes, lakkasid<\/a><\/noindex> tugevdamast OpenLDAP-kliente, m\u00e4rgati probleeme meili saatmisel SMTPS ja SMTP serveritesse STARTTLS-iga. Lisaks ilmnevad probleemid erinevates Ruby-, PHP- ja Python-skriptides, mis kasutavad http-klientide moodulit. Brauseritest on probleem puudutab<\/a><\/noindex> Epiphany, kus reklaamiblokeerimise nimekirjad ei laaditu.<\/p>\n

Go keeles kirjutatud programmid pole probleemile vastuv\u00f5tlikud, kuna Go pakub oma teostus<\/a><\/noindex> TLS.<\/p>\n

Oletati<\/a><\/noindex>, et probleem m\u00f5jutab vanemaid versioone distributsioonidest (sealhulgas Debian 9, Ubuntu 16.04, RHEL 6\/7<\/a><\/noindex>) kus kasutatakse probleemseid haru OpenSSL, kuid probleem ilmnes<\/a><\/noindex> ka APT paketihalduri t\u00f6\u00f6s kaasaegsetes versioonides Debian 10 ja Ubuntu 18.04\/20.04, kuna APT kasutab GnuTLS raamatukogu. Probleemi sisu on see, et paljud TLS\/SSL raamatukogud t\u00f5lgendavad sertifikaati kui lineaarset ahelat, samas kui vastavalt RFC 4158 v\u00f5ib sertifikaat esitada suunatud jaotatud ts\u00fcklilise graafina mitme usaldusankruga, mida tuleb arvesse v\u00f5tta. Sellest probleemist OpenSSL ja GnuTLS oli<\/a><\/noindex> , et see j\u00e4tkab 48-voldiste toites\u00fcsteemide kasutamist.<\/a><\/noindex> on juba aastaid<\/a><\/noindex>. OpenSSLis on probleem lahendatud harus 1.1.1, kuid GnuTLS<\/a><\/noindex> j\u00e4\u00e4nud on parandamata<\/a><\/noindex>.<\/p>\n

T\u00f5rke k\u00f5rvaldamiseks on ettepanek eemaldada s\u00fcsteemi hoiust sertifikaat «AddTrust External CA Root» (n\u00e4iteks eemaldada failist \/etc\/ca-certificates.conf ja \/etc\/ssl\/certs ning seej\u00e4rel k\u00e4ivitada «update-ca-certificates -f -v»), p\u00e4rast mida OpenSSL suudab korralikult t\u00f6\u00f6delda sellega seotud ristsertifikaate. APT paketihaldurit kasutades v\u00f5ib oma riski ja arvestusega keelata teatud p\u00e4ringute sertifikaatide kontrolli (n\u00e4iteks «apt-get update -o Acquire::https::download.jitsi.org::Verify-Peer=false»). <\/p>\n

Probleemi blokeerimiseks on Fedora<\/a><\/noindex> ja RHEL<\/a><\/noindex> soovitatav lisada AddTrust sertifikaat musta nimekirja:<\/p>\n

trust dump —filter «pkcs11:id=;type=cert» \
\n > \/etc\/pki\/ca-trust\/source\/blacklist\/addtrust-external-root.p11-kit
\n update-ca-trust extract<\/p>\n

Kuid see meetod ei t\u00f6\u00f6ta<\/a><\/noindex> GnuTLS jaoks (n\u00e4iteks j\u00e4tkub sertifikaadi kontrollimise vea kuvamine wget utiliidi k\u00e4ivitamisel).<\/p>\n

Serveri poolel on v\u00f5imalik muuta<\/a><\/noindex> sertifikaatide j\u00e4rjestust usaldusketis, mida server saadab kliendile (kui \u00abAddTrust External CA Root\u00bb sertifikaat eemaldatakse nimekirjast, siis kliendi kontrollimine \u00f5nnestub). Uue usaldusketi kontrollimiseks ja genereerimiseks v\u00f5ib kasutada teenust<\/a><\/noindex> sertifikaatide loetlemine usaldusketis, mille server saadab kliendile (kui «AddTrust External CA Root» sertifikaat eemaldatakse loendist, siis klient suudab kontrolli edukalt l\u00e4bida). Uue usaldusketi kontrollimiseks ja genereerimiseks saab kasutada teenust. . Sectigo on samuti<\/a><\/noindex>pakkunud alternatiivset ristirasitatud vahe-sertifikaati \u00ab<\/a><\/noindex> alternatiivne ristsertifitseeritud vahesertifikaat «\u00ab, mis kehtib kuni 2028. aastani ja v\u00f5imaldab s\u00e4ilitada \u00fchilduvuse vanemate ops\u00fcsteemide versioonidega.<\/a><\/noindex>«, mis kehtib kuni 2028. aastani ja v\u00f5imaldab s\u00e4ilitada \u00fchilduvuse vanade ops\u00fcsteemi versioonidega.<\/p>\n

LibreSSLis. ilmneb<\/a><\/noindex> 30. mai m\u00f6\u00f6dus 20-aastane t\u00e4htaeg AddTrust'i juur-sertifikaadi jaoks,<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u0434\u043b\u044f \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u0438 (cross-signed) \u0432 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430\u0445 \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043a\u0440\u0443\u043f\u043d\u0435\u0439\u0448\u0438\u0445 \u0443\u0434\u043e\u0441\u0442\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0438\u0445 \u0446\u0435\u043d\u0442\u0440\u043e\u0432 Sectigo (Comodo). \u041f\u0435\u0440\u0435\u043a\u0440\u0451\u0441\u0442\u043d\u0430\u044f \u043f\u043e\u0434\u043f\u0438\u0441\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u0438\u043c\u043e\u0441\u0442\u044c \u0441 \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438, \u0432 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u043d\u043e\u0432\u044b\u0439 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 USERTRust. \u0422\u0435\u043e\u0440\u0435\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u0434\u043e\u043b\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043b\u0438\u0448\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":83444,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83443","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47AddTrust'i juur-sertifikaadi vananemine p\u00f5hjustas t\u00f5rkeid s\u00fcsteemides, kus kasutatakse OpenSSL ja GnuTLS | ProHoster","description":"\ud83e\udd47AddTrust'i juur-sertifikaadi vananemine p\u00f5hjustas t\u00f5rkeid s\u00fcsteemides, kus kasutatakse OpenSSL ja GnuTLS | ProHoster","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0441\u0442\u0430\u0440\u0435\u0432\u0430\u043d\u0438\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust \u043f\u0440\u0438\u0432\u0435\u043b\u043e \u043a \u0441\u0431\u043e\u044f\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 OpenSSL \u0438 GnuTLS | ProHoster","og:description":"30 \u043c\u0430\u044f \u0438\u0441\u0442\u0451\u043a 20-\u043b\u0435\u0442\u043d\u0438\u0439 \u0441\u0440\u043e\u043a \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 AddTrust, \u043a\u043e\u0442\u043e\u0440\u044b\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ustarevanie-kornevogo-sertifikata-addtrust-privelo-k-sboyam-v-sistemah-s-openssl-i-gnutls","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-31T11:42:09+00:00","article:modified_time":"2020-05-31T11:42:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83443","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:17:29","updated":"2022-09-28 18:33:53","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/83443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=83443"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/83443\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/83444"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=83443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=83443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=83443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}